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Executive Summary 

On July 9, 2016, Anonymous-affiliated actors announced physical and cyber-based protests against police brutality 
for a "Day of Rage" on July 15, 2016. We believe that the Day of Rage poses a low threat of distributed denial-of- 
service (DDoS), data leak and defacement attacks against U. 

Overview 

On July 9, 2016, Anonymous-affiliated actors announced physical and cyber-based protests against police brutality 
for a "Day of Rage" on July 15, 2016. We believe that the Day of Rage poses a low threat of distributed denial-of- 
service (DDoS), data leak and defacement attacks against U.S. Government and law enforcement websites. 


Key Points 


• Anonymous-affiliated actors announced physical and cyber-based protests against police brutality for a 
"Day of Rage" on July 15, 2016. We believe that the Day of Rage poses a low threat of distributed denial-of- 
service (DDoS), data leak and defacement attacks against U.S. Government and law enforcement websites. 


Threat Detail 

Anonymous-Affiliated Actors Announce 'Day of Rage' for July 15, 2016 


Actor: Anonymous-Affiliated Actors 


TTP: DDoS, Data Leak, Defacement 


Threat: Low 


Date: July 15, 2016 


Summary: Anonymous-affiliated actors announced physical and cyber-based protests for a 
"Day of Rage" on July 15, 2016. The physical protests have already established locations and 
times in major cities. The Day of Rage (aka #FridayofSolidarity) is meant to protest the deaths 
of black men by police officers, such as the recent deaths of Alton Sterling and Philando 
Castile. The Anonymous-affiliated YouTube channel "TheAnonMessage" released a video on July 
9, 2016, in which they claimed to have already compromised the Baton Rouge, LA and Saint 
Anthony, MN police departments and are threatening to conduct a data leak. Since they 
provided no further evidence of this alleged compromise, we surmise that they do not have 
access to these systems. 


Analytic Comments: 

We believe that the Day of Rage poses a low threat of distributed denial-of-service (DDoS), 
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data leak and defacement attacks against U.S. Government and law enforcement websites. 

• We have not observed any cyber threat actors discussing upcoming cyber threat activity 
related to this campaign. 

• The majority of individuals sharing information about the Day of Rage are not cyber 
threat actors. Therefore, participants are more likely to engage in physical protests 
than cyber threat activity. 

• Since the video only mentioned unspecified cyber threat activity as a method of protest, 
any threat activity conducted will likely consist of DDoS attacks, data leaks and 
defacements, which are the most common attack methods used by Anonymous-affiliated 
actors. 

• Historically, we have seen little to no substantial cyber threat activity in conjunction with 
Anonymous-affiliated Days of Rage since they tend to focus on physical protest events. 
TheAnonMessage previously promoted earlier Days of Rage protests; however, those 
videos did not contain any threats of cyber threat activity. 

• We have observed substantial amounts of cyber threat activity in retaliation for 
perceived police brutality, such as the recent hacktivist operation #OpBlackFlare ( 16- 
00010656. lulv 11,2016) and previous campaigns #OpBaltimore (see 15-00004474, 
May 22, 2015) and #OpFerguson (see Intel-1217685, Aug. 24, 2016). However, there is 
no indication that actors involved in those campaigns are seeking to engage in the Day 
of Rage. 


Related Reporting: 

• 16-00010624 (Hacktivist Response to Deaths of Philando Castile, Alton Sterling and 
Dallas Shootings Include Low-Level DDoS Against, and Non-Sensitive Data Leaks from, 
Police Websites) July 9, 2016 

• Intel-454951 ('US Day of Rage 1 Protests Not Planned to Include Cyber Attacks, Though 
Potential Exists Among Anonymous Sympathizers) Sept. 7, 2016 
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This message contains content and links to content which are the property of FireEye, Inc and are protected by all applicable 
laws. This cyber threat intelligence and this message are solely intended for the use ofthe individual and organization to which it 
is addressed and issubjectto the subscription Terms and Conditions to which your institution isa party. Onward distribution in 
part or in whole of any FireEye proprietary materials or intellectual property is restricted per the terms of agreement. By 
accessing and using this and related content and links, you agree to be bound by the subscription terms of service . 

For more information on this or other FireEye products, please contact info(5)isightpartners.com 

For more information please visit: https://mvsight.isightpartners.eom/report/full/16-00011000 
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